The vulnerability arises from an inappropriate implementation in V8 of Google Chrome, allowing a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. This leads to a potential escape from the sandbox to the host system, giving the attacker control over the victim’s machine. The weakness is identified as both CWE-119 (Buffer Overflow) and CWE-94 (Code Injection), underscoring the severity of memory management and code execution flaws.

Google Chrome browsers prior to version 146.0.7680.75 are affected. The issue is vendor-wide and applies to all operating systems that run Chrome, as indicated by CPE strings for windows, macos, and linux.

The CVSS score of 8.8 classifies the vulnerability as High severity. An EPSS score of 23% indicates a moderate probability of exploitation. The vulnerability is listed in the CISA KEV catalog, confirming that it has been used in the wild. While the description does not explicitly state the attack vector, it is inferred that the exploitation requires a user to open a maliciously crafted HTML page in an affected Chrome instance. Once accessed, the attacker can run arbitrary code within the sandbox context, potentially compromising system integrity.